How? It's signed with their keys. Linux kernel also uses mail lists and I have yet to see someone trying to impersonate someone

I haven't seen anything about requirements for gpg. Also the ux of it is not so great, so it's easy to just not have a signature without causing too much suspicion. Would be a much easier attack than what Jian Tan pulled off. Just wait for some contributor to go on holiday and send a malicious v2 patch. There are so many patches in the linux kernel processed that no one wouldn't notice.

Aren't messages and/or patches signed?

I can't see any of that. They even tell you to not have any gnupg signatures: https://www.openbsd.org/mail.html